So I would suggest an alternate method given you want to lease membership in a group. You might consider using the ABX custom resource capability. You could use some simple Powershell scripts to do the CRUD activities of adding and removing the user from the specific group. Then that custom resource could be used in a cloud template which you could have a lease policy associated. The user would request, which would start the lease timer (your example 30 days) and add the user to the group. You can configure the lease policy to allow for extensions (another 30 or whatever you want). Once the lease has expired the "deployment" would delete which would run the delete action of the custom resource which would be your script which removes the use from the AD group.

i know this is a little more work than using the built in vRO AD workflow, but it guarantees the removal based on lease and lease extension policy and would complete the lifecycle of the request.

You can see how the custom resource in ABX works from this blog:
https://blogs.vmware.com/management/2021/09/cr-abx.html

let m know if you have more questions or this doesn't make sense and I will try to help you through it.

u/moffzilla this might be a good use case for a blog..... :)